Pentest Agent

pancakeswap.finance

Public security posture · Completed

Share on X

Security grade

C
Configuration score72/100

Grades reflect only the externally visible controls listed below. A good grade does not prove the application is secure. How grades work

0
High
2
Medium
2
Low
3
Informational
12 of 19 assessed checks passed · 1 not assessed

TLS & transport

All checks passed
HTTPS works with a trusted certificatePassed
The homepage loaded over HTTPS and the certificate was accepted.
Final URL
https://pancakeswap.finance/
Status
200
HTTP redirects to HTTPSPassed
The unencrypted homepage immediately redirects to HTTPS.
Redirect
308 → https://pancakeswap.finance/
HSTS is enabledPassed
Browsers are told to use HTTPS for 365 days, including subdomains.
Strict-Transport-Security
max-age=31536000; includeSubDomains
Legacy TLS not assessedNot assessed
Our scanning network could not open a raw TLS connection to this host (proxy request failed, cannot connect to the specified address. It looks like you might be trying to connect to a HTTP-based service — consider using fetch instead).
TLS 1.0
unknown
TLS 1.1
unknown

HTTP security headers

3 findings
mediumConfirmed

No framing protection

Any website can load this page inside an invisible frame and overlay it with misleading content.

X-Frame-Options
(not set)
CSP frame-ancestors
(not set)
Recommendation · Add Content-Security-Policy: frame-ancestors 'none' (or 'self'), and X-Frame-Options: DENY for older browsers.
Why it matters ↓

Without framing protection, another site can embed this one invisibly and trick users into clicking — for example approving a transaction.

How we check: Checks for X-Frame-Options or a CSP frame-ancestors directive.

https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html
mediumConfirmed

Content Security Policy missing

The browser is not told which script sources to trust, so any injected script will run.

Content-Security-Policy
(not set)
Recommendation · Start with a policy such as default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none', then add only the origins the app needs. Use nonces or hashes instead of 'unsafe-inline'.
Why it matters ↓

CSP limits which scripts can run. For dApps it is the main browser-side defence against an injected script draining connected wallets.

How we check: Reads the Content-Security-Policy header and flags policies that still allow inline or arbitrary-origin scripts.

https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
infoConfirmed

Permissions-Policy not set

Embedded content may request browser features the site never uses.

Permissions-Policy
(not set)
Recommendation · Add a policy disabling unused features, e.g. Permissions-Policy: camera=(), microphone=(), geolocation=().
Why it matters ↓

Limits what embedded third-party content can access, such as camera, microphone or payment APIs.

How we check: Checks for a Permissions-Policy header restricting powerful browser features.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy
MIME sniffing disabledPassed
Browsers will respect declared content types.
X-Content-Type-Options
nosniff
Referrer-Policy is setPassed
Policy: strict-origin-when-cross-origin.
Referrer-Policy
strict-origin-when-cross-origin
No exact versions disclosedPassed
Server headers don't reveal exact software versions.

Cookie configuration

2 findings
lowConfirmed

1 cookie without Secure

Some cookies can be sent over unencrypted HTTP.

Cookies
visited
Recommendation · Add the Secure attribute to every cookie set by an HTTPS site.
Why it matters ↓

Cookies without Secure can be sent over plain HTTP, where they can be read on the network.

How we check: Inspects every cookie set while loading the homepage and checks it carries the Secure attribute.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies
infoConfirmed

8 cookies without SameSite

Browsers default these to Lax, but setting it explicitly makes cross-site behaviour predictable.

Cookies
visited, p_exp_web-notifications, p_exp_routing-speed-quote, p_exp_price-api, p_exp_pcsx, p_exp_optimized-amm-trade, p_exp_bridge-v2, p_client_id
Recommendation · Set SameSite=Lax (or Strict) explicitly on each cookie.
Why it matters ↓

SameSite limits when cookies are sent on cross-site requests, which reduces cross-site request forgery risk.

How we check: Checks that cookies declare a SameSite attribute.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#samesitesamesite-value
No session-like cookies foundPassed
None of the cookies set on the homepage look like session or auth tokens.

DNS & email posture

1 finding
lowConfirmed

No CAA records

Any certificate authority may issue certificates for this domain.

Recommendation · Publish CAA records naming the CAs you use, e.g. 0 issue "letsencrypt.org".
Why it matters ↓

CAA restricts which certificate authorities may issue certificates for the domain, reducing the risk of a mis-issued certificate.

How we check: Looks up CAA records for the domain and its parents.

https://datatracker.ietf.org/doc/html/rfc8659
DNSSEC validatedPassed
The resolver authenticated the answer with DNSSEC.
AD flag
set
SPF record publishedPassed
Authorised mail senders are declared.
TXT
v=spf1 -all
DMARC enforced (p=reject)Passed
Mail that fails authentication is quarantined or rejected.
_dmarc.pancakeswap.finance
v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s

Frontend & disclosure

1 finding
infoConfirmed

No security.txt

There is no published channel for reporting vulnerabilities.

https://pancakeswap.finance/.well-known/security.txt
HTTP 404
Recommendation · Publish /.well-known/security.txt with Contact and Expires fields (see securitytxt.org).
Why it matters ↓

Gives researchers a clear way to report vulnerabilities privately instead of disclosing them publicly.

How we check: Requests /.well-known/security.txt and checks it contains a Contact field and has not expired.

https://securitytxt.org/
No mixed contentPassed
All resources referenced in the homepage HTML use HTTPS or relative URLs.
No third-party scripts in the HTMLPassed
All script tags in the homepage HTML load from the site's own host.

Scope & limitations

Assessment type
Public, non-invasive
Target
pancakeswap.finance
Final URL
https://pancakeswap.finance/
Resolved addresses
172.67.75.76, 104.26.3.169, 104.26.2.169, 2606:4700:20::ac43:4b4c, 2606:4700:20::681a:2a9, 2606:4700:20::681a:3a9
Scanned
Oct 20, 2026, 11:12 UTC
Duration
1.7s
Requests made
12 (budget 60)
Report ID
e3phnagca4
  • This is a public, non-invasive assessment of externally visible configuration. It does not test application logic, authentication, APIs, smart contracts or wallet flows.
  • Only the homepage and a small set of well-known paths were requested. Other pages and subdomains may be configured differently.
  • A good grade means the checked controls are in place. It does not prove the application is secure.
  • 1 check could not be completed and was excluded from the score: Legacy TLS.

Own pancakeswap.finance? Verified owners will be able to request authorized deeper testing and receive findings privately. To dispute a result or opt out of public assessments, see opt-out & abuse reporting.